The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to run a shell command /bin/rmbc-workspace active "<user's answer>" using a freeform response from the user. This pattern is vulnerable to command injection if the user input contains shell metacharacters like semicolons or ampersands, potentially allowing arbitrary code execution on the user's machine.
[DATA_EXFILTRATION]: The skill preamble executes a local binary rmbc-analytics to log usage data (skill name, product, and tier). This constitutes a telemetry channel that transmits local usage information to the vendor's infrastructure.
[EXTERNAL_DOWNLOADS]: The skill includes an update check mechanism via the rmbc-update-check binary and references an 'Inline upgrade flow' that reads from external skill files, introducing a dependency on remote content that may change over time.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting external data without sufficient isolation. Ingestion points: The core_product, price_point, and target_audience inputs are interpolated directly into the instructions. Boundary markers: The skill does not use specific delimiters or instructions to the agent to treat these inputs as untrusted data. Capability inventory: The skill has access to shell execution, file system modification in the home directory, and the ability to open URLs. Sanitization: No escaping or validation is performed on the input fields before they are used to generate the prompt.

bonus-stack